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[#»&] 
[ftfc] 

[ft*] 

[ft*xt±*#] 
[ft*xi±*#] 
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¥J&14^ 8^200 
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jiCMfPitE^sT §7t it a ^m^^^ttrt 

Lilff^ life 
000004237 
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IS 1 
@I 1 

H&J# 1 
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[Hfjfrgl] IHU*? h7-^t^y h 7-* tWCtt^, 

* -7° n -t * £ i" * c -cft?w|ri *tfc*n-r £ #S=lfcfcJ¥IS: * * L , 
HufE7 r >f T7 * -;i^fiW\ 

A7J I P ^ ? h y ?m X Xf7 4 )V *? i; > ^ftt:i^>t, i§» 
A7J I P/^ y h fr^a-r^^S^^r^J^-r^^^^ 7f7^ 'J 

^:31$tL7tA7J I P/^ y h<D^ y V\t J: tfS 0 5Ht^fM3go*^-C, 
^fgA* IP^n C7)$s^5fe L T tufS 1*1 §(5 * y h 7 - * is «t CTWIBiS «9 ^ 

* mm* & y * * * v > r&ftmm^m t , 

[If *^ 2 ] A7J I P'tfr y b OffrfS^ v ^fitffcti^ATJ I P^^ ? h 
(Ommitl PT KP^^i^I PT Kl^<?>^&< tfe-^f*!?, 

*Slfe-t^5'^H|8q¥L-C^«A* I P^y h^Kl^^^t^, 

lltrSErtSB* y h 7-^-ejtffl^tLTv^v^ i pt Ki/^^f,^i.ii';^ h£ 

BUl£A77 I P'tfrv WfoVtl PT K !✓ 7, t m I Elf m 1 J * M^O^ffl I PT 

ztzafrmt-tz 1 ibises; Rrtp -^tAo 
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2/ 



[it Mm 5 ] ;v y 'j > ^fwi^is:^ Buisio £ *) ^s-ms^i 

LfzXJj I P y h <£>^ y ?m 7 1 )V 9 U > t 

* »; > r^-WL'^&t - t t ~r %> amm 1 §eiro:&*i*«i ^ta„ 
6 ] trie -7 ^ ;v * >; > ^^#fi#^{t 
Mffi^si^^^s^tMnu/i^oijcs^T-^'; tMmxu i p^y h 

<£> 7 K V7, If * t=*d"JC& Lf;7^H'J> 7*#^ * ^^-T * t , 

[»^7] was*? Yv-trttw*? hv-r toytrnzmtztL, 
at 19 x&7 r 4 7 7 * - ^mw.^tsTkWfini' *r- acuk , 

frf£7 r 7 7 * - ;mtii, 

atj i p y h y ymm& «t « fr^m^o*^-^ immatj i 
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^-v! 3/ 



o 

i i ] mmmmmwm^mt. mmxti i y v^^® 

1 2 ] liuM^SWS^^ 
HUWB0 1 ^ffiJtl&lfi^^rt§<7)^^^1-^ fc*!>0& 2 « t 
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^-v: 4/ 



1 2 |B«o#*l*ai y^TAo 

« 1 6 %m<D&&mm -> * t- a 0 
mmy 7 ^ r 7 * -^mm*. 

mzm^^x, mmxti 1 p ^ ? h * fria& 2 ei*M#siJ «t rais^ t 
1 p y h (omm it 1 p r k n*t-r*«ftjR*iKriBfli »Kifif3#gt0»<biR 
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5/ 



y t+> *-)\smw.^&wz>&t muz m^tzTkmm®7i&^&^x > 
fitz x-n i p y h ^ •> rmms x vmmm ^ ftumm^m^x 

, MtMXt) I P >**r y V <Dl&m9t t LXmUfoU* y h r 7-9isX CFMISis t •) 

CO V > -f tL^ £ MIR L > 

fri" ^^^-e^co^it^^L, 

[If JftS 2 0] A7J I P 7 h cofrffi^ ? ^fil #fi^i(A7J I P y 

iuiha^j i p/^y v<7)^y ymmtmmmvfri'tgcftzmfzi-fr&frizmft 

[it ^ 2 1 ] frffis *? ^ti=fw> HufBWgB^ vyv-z xmm £ *LT 
mmxts i p^^-y hco^ iptki/^ tmtsMmvx vpwjz&m i pt 

o 

2 3] frfB 7 ^ ;u 9 V > ^^ftfl^ f- v 7I±, 
tuffiis £ (9 mWr<m3s LfzXtl I P v b co^ -y rif mKMlBir h v 4 9 



2003-3068006 



#SS 2002-238989 ^- V ; 6/ 

tufSA* I P >t*r y h K*tJfc1-£ 7 4 ;v * 'J > ^&#<&;fr&»§ LTV* 

[It^ 2 4 ] huIB7 * ;v 9 'J > ?0kftWmx t y 7l±, 
MIS L 7t: "7 )V ? } ) y U 

"7 r >f T 7 * - K is ^ & is i: ^tt * ffl v » fc#£H?ai is ^ x , 
I P y h <7)ig i) #tt£#£fflfc U 

[fflf*® 2 6 ] HUffiM fRJg£ffc# f & 7s t- y 7*l±, 
£ r t iz ^ MISS * Mr L , 

una u r ;v * >f a mnm r- ? ^ - * o * w k«« l -css^t ise ^ 
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7/ 



A# 1 p -7 b <t>^ y vmWi& £ if 7 ;v 9 > ?*MNi*o-v>-c, ^itA 
i^A^j i p v v <D&m$tt Lxmuftw* ? h 7 - ? & £ vm&& t *> mm 

30] was* y h v - * t tm^ vYv-tt (Dmm^mm z n 
atj 1 p^^-y h <d^v rmm& zv^m.*) frtf&ft^m^^x, mmxts 1 

3 1] rtffi^ y h 7 - * t fl.8B* '^7-^ <7>^UCl£S $ *i 



ffifiE#2 003-3068006 



#11 2002-238989 v : 8/ 

m^xui p^*? hKteifz&mnTti pt YV7,<Dmm&*mm.-t&tz 

ttrifis i &mjtmiR^&ii, xti i p ? v y rmn& x &m 1 
ft-K&^T, mmxtn P'^y v*mz%2m.^m^%i&&xfmttt 

t#U ^MISJS^2pJf^^*M7t:-r^^^)Si:-C^i^A^ I P/f^y h 
[If mm 3 2] rtgp^ y h 7 - * y h 7 - * t Oi^Hf&M $ *l 

, at ^ mmzmmztiti? t 4 t v * - ^mmz&^x , 

Xti I P y \ y i <^7 ^ ;i/ * <; > ^fem~*-^T, ifA 

f££n L^S^^o'v^t, ^l£A£f I P^y- y h \znfc-f%> y j )V? «; >^ 
ft * fit & 7 * ;i/ * ij > ^^#flft <h , 
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^-v: 9/ 



[»^3 3] mifS&<h >)Sf * J: WIB 7 7 >f 7 * - A'gf lif 
At) I P^y h^^-t^/^ y 

[IStJS 35] rr > fc?^- * tc, y Y V - 9 btim* y ^7-9 t 

\ts i ps*v~ y v <7>^ y rmm& x zrmzy * * 9 v y r&mzm^^x, m 

, ^IJCA* I P^-y KoKSftt LTtflBrttt*? h V-9& ZTm&tsb *) 

^^^Ltc^S^^^o'v^t, ^A# I P^y -y h K**Jo-T& 7 

[If ^ 3 6] rr > e a - 9 7^7-^ 7^7-^ 

<?>^# KfSflt $ fifz y t J T u * - )vmw. K £ it £ £ «9 ^fi * ffl v > iz&mm 
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^-v: 10/ 



v7 7- A tztb<D~7°U 7*7 A KfcV^T, 

im^M 3 7] 3 > fc? jl - * fcfl-SP* -y h 7 - 7 h 

7n77 Atcisv^-c. 
W5iP^^^f 7"lf «t ;i/7 'J y y&ftK&^^x* M 

, Ml&Xt) I ? b <DUrk%t LTttSBflSB* -y b 7 - 7 J3 J: fffe£ t «5 

Huffish 0§£SK*tLT, KitL^ATJ I P'ifry h«ffl»t-^7'n^ 

I P/^y bo^^t&ttfcffifcU 

m&jnxn i p^y htwistt*#^ffixi P7 Ki/xofit^L, 

A7J I P^ y b O^ijf 7C I P 7 F V 7 tzftir Z> js^E^mflSM 0 frUr&flr* 
itt^-r^S^^iSCT. SI^ATJ I P'^ ? bO^SiSfcfc LTirfai*lSG* ? b 7 
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^-v: 11/ 



[0 0 0 1] 

[^<^fi1-£i£#rfri?] 

v X f A & <£ 0* 7fy£ H m ~? h o 
[0 0 0 2] 
[^*<^Wf] 

<Z>gc3EK*t1- £ Bfrflmfif tLt, (1) 77>f7 
**-/K (2) iA»XfA, (3) fcif)y^fA, fcv*ofc#ftj&*3b 

[0 0 0 3] 

7 T-T Wi, /chx.{i^i¥8- 4 4 6 4 2^$gtc^^$tt 

VV- 7 ^MMZ^tXX^fr^ fremiti- %o #^ 7 r 4 TV *-JUlz 
VX) %¥<Qm, 7°u Y n;VOffiglJ (TCP/UDP/HTTP^if) ^\ f- 

[0 0 0 4] 

ftA^y^fAW- Z:tx.iilPi2 001-35067 S^WU^m 
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) 
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^-v: 12/ 



[0 0 0 5] 

l)y^fAO|lWi, tzt^\tm^2 000-26148 3^»^H 
^^ttTV^o ^<7)^<7)i5^ K) y^fAIJ, 1 0OTtC«H$tLfcF«3S|5 

-T^o ftiH— *Ki§£*i£/^y l>£MHmfRU F*J^^-7 f7-^± 
[0 0 0 6] 

33 0 y7fA(0|2Wi, fct Atf#g8 2 0 0 2 - 7 2 3 4 2r#&C|ii§^£ ft 
O^-l-^) tWC, v>=b*9>&y- h 7x^f t LT, 
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) 
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^-v: 13/ 



^iE^ffi-^-^-etttB^^Tt^iE/^y M±, «»W twist /^Siai-t* 
[0 0 0 7] 

$<bK, jst 0 vXT-Aco^3^0(i, ^:i:x.lf#ri¥0 9- 2 2 4 0 5 3^f 

yyZftio tztzL, y^fA«^ >^7x-xii IP7KU 

t r a c e r o u t e & iTSrfflv^ai^f, B - t £ 

#f^)lotn o ^ lootttLT, 7^7^^- b * -y h 7-? Ufa**"? 
mm^^y Mcov>r. ftff^y h7-7i:grait^>:i:itiSo ftfr 

* y h 7 - ^.LiCfi 0 £J2JUbOftfr*.X b 35*K»t <b *l> "7°^ >f ^- b * >y h 7 - 

* y h 7- 9-frh<F>T%&fr h-fU^- Y * y Y^-? *%mx%h 0 

[0 0 0 8] 

[5&W3&**sttJ:-5 t-rzmm] 

[0 0 0 9] 

% 1 OWIjaii, ^^ y h 7-^±c7)^^^ h fcFW* y b7-7±Wt 
-/^t^pg-C^ SSL (Secure Socket Layer) ^IPSe 
c (RFC 2 4 0 Item) ifc'Wimit^ft^fflV^ftfc^t:, Ijt«£ 
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^-v! 14/ 



o 

[0 0 10] 

[0011] 

M £ » T £ & v > fc *6 "C * & o 
[0 0 12] 

v>£v> 0 d<7)7t:&M;. IE?iK/^ -y h £Jg «95^t&^ h^-eiT, lEHt&T^-b 
* **ftff ^'^7-^^ H# & T * -t X 7& ? [*I^ ^mfrtiZ "Tf£14 

[0 0 13] 

7 r ^ r u ^ - )vmm.^w^ir h z\ t 

[0 0 14] 
[0 0 15] 
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^-v: 15/ 



[0 0 16] 

£ ffi'fc-f Z> tz <D^m 

at mmzy r 4 r iy * - )^mmfrh$mz ttfz ajj i p^y-y bizn-r&v- 
- ex y u -t x * -t sit -eijc^o^te ^^-r & xxmrn^®. * m l , ? 

7^7->t-^iii> A7j I P^-Jry h<D^y ymm&xv 1 ? 1 >; 

9 > x^ <h , n?- atj i p y h <7)^ r-it m& x z/m *) frw&ft 

mat ymw^^-rti^im^-r^m^mM^t^ mm&t ^mm^$mL 
tzAti i p^y-y h KmLxmmM^^m^m^MLtz^^zm^ 

[0 0 17] 

^m^llifSM^^tt^^^^i-^S^^DT^^ATJ I P^y h<7>S£ 
[0 0 18] 

«t &#^f|J?jy*fcJ\ A7J I P ^y- y Y v r-|f «t tf? >r ;u * 
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^-v: 16/ 



ft U flfzXtl I y h y J: ^ 0 ftlf&ftK&^X 

tw»Rt*^S^**J3ei-4ifc^*oW*l*«aiL, MIBAtJl P^y h 
*f)£-f £7 -f 'J >>?$z&*WLfcL, AT: Lfz I P^*- y hOA 7 ^fif#K*f 

[0 0 19] 

iSL< fi, *^i:J:477'f7^t-^tl± > A7J I P/^y Foa 7 
^tilfR j3 £ £T7 ;w ^ 'J >r^ft^*-^v^T^^A7J I P^ y h SrgS-t&ri* 

HufSrtgP^-y h 7 - * is =t tufeis ov^f ^^I^f^^lKf 

[0 0 2 0] 

HIKi, **Wi:J:4$*Hil|l^fA?)jWill57 , n^at*4o 
2 £WL, ^>?-^7h3 £[*Fg|$*y h7-^4 t <7)^#tC7 r >f T 7 * -/!/ 



mt£# 2003-3068006 
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^-v: 17/ 



^fi 1 # ? t3:g£*L-C^& 0 1*385* v h r 7-^4(i, WWW (World-Wide Web) & 

*v h 3 C^tc*^ h 3 0 1 ^M?tLtv>-& 0 
[0 0 2 1 ] 

xx^7t*z v 3 o i ^mm-f&o 

[0 0 2 2] 

(» i mmmm 
i . i ) mm 

HI 2 ti, *S&9!0# 1 HJfeBS^ «t ZTkmWffl y^fA©77^f77t-;vg 

1 (i> ^ilfl-f >^7x-xi00t^>^-^7f3 & 1 <£>|*| 

8BjH£>f ^7x-710 4^U^y b7-^4 £^M£*t& 0 
[0 0 2 3] 

^^7^;VM0 1 (±, ^gRiM^f >^7x-xi OO^i tfgt^SB 1 0 

?"7^-* 1 0 OSfcfi^SRl 0 3 0— ^f>$ttJRofe I h«rffe^ 
[0 0 2 4] 

^';h7^^10 1 y h (±lf#^ 1 0 3^|£>*U 

Ml 0 3 (±. f^i-^>M#U * h (0 5) £#JB U ^7-^7^^101 ^ 
hKtiLtzl P^y-y h I P7 K V* KJS Ctil^t y h £f|l <7)F*]g|$ 

iiffi-T 7j-7 1 0 4 UJ:y i l2WWi^>^7x-X 1 0 5 OV>-f ft 



mfiE# 2003-3068006 
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^-v: is/ 



it J >^7x-xi 0 5*^-f>^-^'; Y 3 C|p]^d I y h *>*>r v Y 

~7 4 )V9 1 0 1 ClsiS-r^o 
[0 0 2 5] 

^ 1 ?)|*J^iiif ^ 7 jc-^ 10 4(i, If 2g£R 1 0 3 /d^A^ Ltz I P^°y 
y h £[*J£|$^ -7 F7-^4 Hfsii U v Y*!-? Afrh4 y Y 3 

idfr^? I P/^-y h^M^i o 3^feii1-^»o m2(D\HUmm4y^7^- 
X 1 0 5f±, Ifagfin 0 3 ^cto-rif^^tLTt I P/N°y «7 ()tt2{:fe 
itU *)^fi2 frh4 y*?-% y Y 3lCfoI^d I YZ^MUl 0 3 

[0 0 2 6] 

i3i:^t2(±, -7°n-t:-y^2 0 1 ti%mk$a^2 0 2 t =Sr#tr 0 ^n-t^ 
2 0 1 li, WWW^T e 1 n e t &^>^ v Y 7 - * ^- If* ^Jt^ti"^ -7°n-tr 
X^IffL^^f), ^M-7°n-b^(7)^^^:^^2 0 2^|T«fSii-r^o ijc 
«^^2 0 2(4, 7 0 n-fe-y-»j-2 0 1 frh X73 £ yo^^^ffl*^ L£** 

[0 0 2 7] 

fftlfH ^7i-^ 1 0 6 ^iiLTT^- h £A7Jl-£i:, ffifflfr-^mfcM 
1 0 7 (4, 77- hO|*J#lCt£oT7^-fe*$IJftPJ X M=a^ 1 0 2 OT^-trX 

inn hos«f**»^-r-5o 

[0 0 2 8] 

113(4, El 2 co -7 T >f 7^ jr-^mm. 1 bz&Ur&T ? -txmwv X hwmui 

o 2 o«^w#j&ig-e*&o 7 ?jixmm vxy 1 o 2 f±, 7 ?*xum 

Yr-f^-X 10 2 1, tftmUl 0 2 2 £ <fc tfMff&SSB 1 023 

&o T 5*l7s%m') 7s Yt*-9s<-7s 1 0 2 1 (4, 4>&< t I P7K 

o tkmUl 0 2 2(4, /*lry Y7 J )V? 1 0 1 ^<b I P 7 K V7, & t"Z 



tBSE# 2003-3068006 



mm 2002-238989 



^-v: 19/ 



^tfWv^fcHtr (RQ) £^t&£, T^-fe^SIJ^I 1 ;^ hf-^^-X 1 0 2 1 

fr&aiSBi o 2 3 li, o 7frbxj3LttmmT9*xmn 

i\m) -tZo 

[0 0 2 9] 

IH 4 ii. TttXftm 1 ) X hr*-^^-^l 0 2 1 <7)|*|#£M^ Ltzm^mx 
$>2> 0 7^tXWJ^ h-f'-^^-X 10 2 1 K\$.%mL<VT 7 -fe ^$IJ#P ;V - ;U 

, V-XIP7K1/^ (SRC) ^fnra-y3>IP7K^ (DST 
) %£<D)\s-)VM&$kftt, h<D<£m (ACCEPT) , JgS (DENY 

) , mm (drop) %¥<?>ffij£<D!im3]& (proo ^^-rm^t^m.^ 

ftmv* hT-7^-7, 1 0 2 lt«Lt*<o EI4Hi3V^T. T 7 7 } ) 7 7 
(*) litttOTKV^^^L, ^'7t-7-f)^ftl® "ACCEPT" ii/* 
^-n<7)tl, "DENY" f4 I CMP-i^-il£fl£-t&^ y hJgS, "DR 

op" it i cmpx7-i^^l^w^-7 Ymm^^fL^fiT^-to 

[0 0 3 0] 

Bi5(±, si^i o 3 hfitzmm') 7, v<D—m*^m3m'?:$>z>o m 

mMl 0 3 (Cii, l o^±<D I pr KV^^^^^^i;^ 

^WOOMzgijT. hTfi, rt^P^ -7 h V-7 4 tfO^ffi I PT KPXt5> ? 

h^^ry H4, y h-c^^m^^M^o 

[0 0 3 1] 

[16(4, MJ^-^flJ^l 0 7 ^j%WZtiT^Z>ffifflfr-^7 7i)7°hiM 
Tj^Ltzm^m-C^^o 1£L < (4fJB£-f&^\ TO^-^IJte^I 0 7(4, ( 
REC0N) , « A (INTRUSION), ^(DESTRUCTION) & ^(DXXW&m^t Bfrflj;i/ 

#T-mj l*t l*tJ£-t£ff££T\ 1 o<7)T^-t^W^;v-;K7)|tM^JI^-r^ 
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intrusion: (src:$ is ource_i p_addre s si 

, DST : *, PROC : DROP) 

t^^tzmmmj^t^xjcmmmrt izmmztix^z> 0 ^te^d*. r$ i 

SOURCE — I P — A D D R E S S | J <7>tft^\ fem-?Z>£dlZ^ &t*)m 

[0 0 3 2] 
1 . 2 ) ttffc 

1 . 2 . 1 ) /*-jr 7f7^i^'J^ 

HI 7 f 2 , ^H0^ <7) ^ i J; £ ijcS Rfrfp v x r A co tfrfp * ^-f 7 n - 

v ^7-^'4 'Mnjltfc I P/*$- y y ZftUMmJ ^7x-71 00 "CH 
SIS I P/^ y h v Y7 J )V9 \ 0 1 Uf7 7° A 1 

) e 

[0 0 3 33 

KfE«£*iTv>& V-* I PT Yl'Z**?7*4 4 *-V3 > I PT Fl^&£* 

<omm*T ? Jzxumv * vwmn 1 o 2^m^-r^ 0 r^-bx^'j * m=s 

SBl 0 2 tt, ±ILf:i7 fc, XjjLtz I PT KP^ £ffiv>TT * -txffljftl 'J * 
h-r-*^-* 10 2 1 fclfcsfcU L fcftfcj <7)T?-fe *f|f!lfp ;P 

9 i o ui, fo«yi*ffi»:fto-c, ussi p^-; h«r$ai7tiijKiis-r& ( 

X-tv7A2) o IP^yh^IL^Ii, ill P^7 h£gtij*8Bl 
[0 0 3 43 

, A^n7^^1 0 1 fyhXt) LfzV — X I PT VUX &&mU 1 0 2 2 75 s 

miE# 2003-3068006 
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^-v: 21/ 



JfittiU /^y Y-7 J )V9 \ Q> l^M-fo 
[0 0 3 5] 

1. 2. 2) /ifry Ymm 

m^ffl 10 3 Tti, -y h "7 >f )V9 1 0 1 -C$3ffiStLfc I P/^ -y h 

fc*#J!8L, IS^Ii-^irtfflJjiM^ (10 4**v»lil0 5) 

Uf7^A3) o Hi 5 fcjjcfJ: &f§#';* h fc, 

fiW^f>^7x-^ 1 0 5 ZfrLXMmi P^y f£i3i i)i!2^ 
[0 0 3 6] 

firt^^-y f7-^ 4±wa^Ji:t-A||f 3 0 1 KPJ£U ffiteW-lfA* 
[0 0 3 7] 

->j\ I P^^r y Vtf&t t)mW2^fcmZtitzm&^&, * <D y° n -b y -9-2 

ftm^&mtituzM#iM^ikmfc%iU2 o 2^»i-^ Uf77A5) 0 

BR, i3^(9^fi2(i, 77>f77t-^f 1 frbfxMZUti I P/^y h 

o ^#w»c(4, & t *) mm 2 izrnw:^ 1 pt vis mx btiz x %jijz 

jftSU 10 3 1 £fltx_Ti3 § , A7J I P y Y <Dt*j X t 4 * - v 3 > I P T K 

/^ •y h ^um-ri> x n %jj-&zm^xi> x^ 0 

[0 0 3 8] 

1. 2. 3) fcf*SHft 
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1 ne t %£ l i&±<DftM<7)i)<D£m&-t2>o tztzL, ^mtmm\zid^x It 

Hi^ 0 £#WK:f±, «ilf, Telnet -9— If* (7) if &X*&tU£, Log 
in/Pas sword 7°n yy° V ^<DfeM<D At) ItZft LT, t^tn^ > £ 

LXi> £v^ 0 

[0 0 3 9] 

1. 2. 4) #SM&2n 

VmW.2<OJkWk%Xl&2 0 2-C(i, 7°n-t 0 1 ^^ii^n^ti 

^SHv^cHi-A^Oll^-CJbSo WWW+h- tf X 

LT rwwW-^-b**^j£1-&7 ? n-fc;uig £>flfetf>-9— y^gK* - 7 h7-? 
T^-trX^-t^Cl tfi&v>J ^^iT^m IV u s r/l o c a l /w 
ww/ logsf^n 9LW~7 7^£#£iAtrC£(i&^J tv^'J;^ 
%mft%£<DM&X$>Z> mL<it, mi 2#hs) o 

[0 0 4 0] 

[0 0 4 1 ] 
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• \WLWil :Ping Of Deat h & b*<D*y- \£^ffc$M 

&^£^i- 0 f^^-wat, ^E%m\^m^ ^frcov>r N its 

r/ 1 o c a 1 /www/ 1 ogsf^l/^f- 'J "7 r >T ^ ^itr £ t 

[0 0 4 2] 

i. 2. 5) Tfjzxfamv *h<vg.m 

[0 0 4 3] 

i£t"£o T^-b^$IJ^l;i/-;K7)^^MH(i, 75- h Kf2l&$*i£tiN8£*f Af 

(SRC:$ IS0URCE_I P A D D R E S S I , DST : 1. 2. 3 

. 4, PROC : DROP) 

tmrnztix^zm^, r$ isource_ip_addressi j « 

(SRC : 1 2. 34. 56. 78, DST : 1. 2. 3. 4, PROCID 
ROP) 

(wifp^-^tt, r >7*.7swm wsgp i o 2 romtmsb 1023 'Mas 

Sft, r^-t^$ij^i;x hf-^^x 1 0 2 1 £fc£Jfcit;&03*i* o laJCv- 
X I PT F>Xfci{;f^f ^ ^-vh y I pt Vux<D^^-z>r^-txm 

®^->i<&mzT?*Ammvx h-r-*^-* 1021 ctt^tt^^ 
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£ id ^MniT^-te*fW;x Ft*- 3^-^ 10 2 1 £H$r1-& 0 /:tx.lf 
, T^-t^lUH'JXff-^^-^l 0 2 l^ft^^-v >^|o]<7)5fe@ItcfiSi- 

[0 0 4 4] 

1. 3) 

0 1 Ilii<7)7 7 TV * -)vmw. 1 "Cti, MMU 1 0 3 HiS^T, 
^f^faf^-ys^IPTK^i: co.bs^^:^ J: „ & £ t) 2 ^ 

<6^> I P7 Kl/Xt L*C, rtffi^y h 7-? 4 1,Z is <7> I PT KU^i 

\i3<F>&b *?2tg2T% |*|gB* y h V - * 4 ±&C*l|fccQ £ 

^ ng 2 *mw.-rz><D t iwi tL^> 0 

[0 0 4 5] 

ji#> rCodeRedJ ^ TN i md aj ^^gig^liS:^07-A 
fi> &&iS^L£: I PT KUX^EM^^^^^Aiz I PT K1/X£}I^L&# ? 

[0 0 4 6] 

I pt vux&mmvx hK&ft&z f?^ j y 3ffid*&ii, *7 

r>f;i/-7 *-;H£g 1 t is 0 |§g 2 tOl^»t*«o^4 < — j&fc, -T> 

[0 0 4 7] 

i.4) Xtim 
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[0 0 4 8] 

I 1 2. 3 4. 5 6. 7 8) ftm-v h 4 ±K4 > 9 -y hnj- 

* 4 i«i:77^T^-^i i mmzti, mmw%#- h^x&z 
tcp 8 o#*°- viz&^xwwwv-vxzfeiiti-zist t)mm2mwzti 

Tl. 2. 3. x/2 4J 7& ? fflt^tLT^l9. 0 1 K\t |~1 . 2. 

3. 4J tv^ IP7Kl/7^?aw^tt-6 0 
[0 0 4 9] 

& ri. 2. 3. x/24j ri. 2. 3. u l^g 

7-^4fC[S]ttT, h (y-* iprm: 12. 34. 56. 

78,f^fa->3>IPTm:i. 2. 3. 1) 7^«2*i£ 0 
[0 0 5 0] 

i o on^ijitt^m, F7^vnoi tcfcii^n.&o 

-y hy^U* l 0 TtlzxmmVX M^SB 1 0 2(c*j-LT, < £ 

iSiSYN^7 FOV-XIP7K1/7 T1 2. 3 4. 5 6. 7 8] tTl 
Xfa-y 3 >IP7F^ Tl. 2. 3. lj tZmtJ-fZo Z\<Dm, 

^xmm^-^mzmzMfr&fzibK, rn r 6 j (tcp^^-t) 



[0 0 5 1] 
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£^LTjo*K SRC7^-;l/RhDST7^-;i/Kt<7)&7l> ? M^f££, PR 
[0 0 5 2l 

ftf?£U 0 2 2T1i, f7^VM0 lfrbXJjt LX-5-z.htifzV- 

XIP7KI/X [1 2. 3 4. 5 6. 7 8J fci^fV^r^^-y a > I P7 

n. 2. 3. u to^tf^-tLt, mw%T t-txmnfr-fr 
m&i-&mj}?)T t-txmfflii'-^zmiti-f&o r (src : * 

, DST : 1. 2. 3. 1, proc:accept)j ( TPROC : ACC 
EPTJ liA^IP^yb^i$:/Tt) T * -fc^MfP^-^ig^ L 

Ttt-T^o iOt IfcSftBl 0 2 2fi, T(SRC:1 2. 3 4. 5 6. 7 8 
, DST: 1. 2. 3. 1, PROC:ACCEPT)J &/ilrv V 7 J )V ? 1 
0 1 l,Zjg-f 0 

[0 0 5 31 

T**xiWf|/i'— ^SrSitflfcofc/**- y h7^;^l0 1(i, aSR/P— /pop 
R0C7Y-^F^#1U rACCEPTj *e*-&ii:*ltjB-t*fc, 
KA* I Prtfry h 1 0 3 ^USirf^o 

[0 0 5 4] 

f^v>T, M*^10 3-Cii, ^tUfcofcATj I P/^ y hOf^f XtM 

rt^J^ft-C&fK loi« Tl . 2. 3. 1J t^^^if^o C(7)ft^ 
. 0 3i£. A7J I P/ltry h©f^f-{ > I PT Kl/^ Tl 

. 2. 3. 1 J ri*8Nf'j;* hfcflB*£*LTV>&Ofci*eLfc&, ^A2J I P'< 
"r-y h Z&t *) mW 2 ^^£*LTV>;z> f 2«It^f >*"7jl-* 1 0 5^ 
<5:f5iii-^ (0 1 0#bs) o 
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[0 0 5 5] 

& 0 io^ f9^e2-e{i^OWWW-9--^X76 ? fiti)LT^!9, 

N/^-y h Z^mtfZ t&K y SYN-ACK/^7 h^^OV-^ IP7K 

i/x (-t-^^*>ijc«7c*^ h 3 o i ) ^fo]ttrtti^-r^o 

[0 0 5 6] 

v 3 o i tat i}^i2 t^mxrc p&mm±Kotz£>(Dmm 

[0 0 5 7] 

&t t)tt2t(t 7 0 n-t-y+h2 0 1 tWWWt-ex^IjcSTC*^ h 3 0 1 

*7-^T^-bX& ^Ol&fiMfcia £ , JfcSftM 2 0 2 ^il^W Hii^J-r £ o liC* 
7C*X h 3 0 1±07-Ali, ^) 11 2 ±(Z)WWWt- if ^ L t , 

[GET /default, i d a ? NNNNNNNNNNNNN (200 
*4 hflJS^^I^^IL) — %u 0 0 0 0%u 0 0 = a HTTP/1. 1 J <h 
o^S:^J^t>*&i ^Hftw^i*^ 7 4: - y ^ WWWt - H7 t:M L t A* 

* ±<D v * -r A^Jt K =r tf- L Mm=>- KSrUffi" Si^ft^^^KS:* 
ff"t"*o L^'ot, AI^Ft:, 7°n^7t2 0 1ii, '>^fAflj^ 

2 j&*$»ttt»tfcA2j I P'^ y Fo^t-^ff^tiSIt^o 
[0 0 5 8] 

&*lfcfc]8B2 0 2ii, f*!)7'n-t7t2 0 1 JiOWWWt- if *OjgIE&l&f£ 
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t^*u n^f & if k ffi 1- z> $ t v > * 0 

[0 0 5 9] 

---e. mfSe^-A^g^con tf-^*§tli1-MBff^ rc : ¥Wi n d ows 

TWR ITE, C:¥Inetpub¥wwwroot ¥_v t i_l o g¥ 
*; INTRUSION] (TC:¥Inetpu b ¥www root ¥_v t 

kmk-t&o z<Dt%, %.wtkM2 o 2t±, mmi*(v r; j wt£#pbu 

INTRUSION (f A) *x^iM;«i-^^^ofci:*iJ^-r^o 
[0 0 6 0] 

XIPTKV'Xt, ^m^^Tti^cS^^T-^';^ n NTRUS I ONJ 

7x-7io 6^fsiii-^ (mi imm) 0 

[0 0 6 1] 

flJftK >^"7^-^ 1 0 6^m^fttzTy- Y ItWM^-^l^Ml 0 7^ 
[0 0 6 2] 

INTRUSION: (SRC : $ (SOURCE I P A D D R E S S ( 

, dst:*, PROCIDROP) • • • (1) 

)v-)is¥\mffl i o 7 w^-^^i7 r >f )\/*ft?t h#bb t> r i nt 
rusionj *f-^vtcit(ii.i"«Rffti^-^"e**S: (1) £J*m-r& 0 *l 
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7KI/X [1 2. 3 4. 5 6. 7 8J (t4*>*>ftf%*^ h«I 

Ciot, T$ (SOURCE IP ADDRESS} J ^riSJ&L^ 

(SRC I 1 2. 34. 56. 78, DST : *, PROCiDROP) 



t^7T?-txftmfr-fr*£.1&1r2> ( TDST!*J tiffifco-T*^ Xr^ 
y3>IP7Kl/Xt:Mtl>) o Lt, ^afgT * -fc x ftijip ;v - ;v £ T ? -tx 
ftljfp 'J^b 1 0 2 ^git £ o 
[0 0 6 3] 

T?-kxmmv * Mffsasi 02m iw^-^j^i 07^^(07^^ 

3-eii, ^ (2) -ejjkzti&T ft^rn'M^-^z, rt-t^mm 1 ) * hr-? 
i o 2 1 Kfcjiu t<Dmw*¥ii7F-tz>o r?^xmw } ) * hr-?s<- 

X 1 0 2 1 tit ^ (2) t:^$tL^T^-fe^^;w-;v^iiin1-^ J: •? KjEfr 
M^tf^o 7^-bxiWJXI-f-^-xi02 1 (i, ^nm%<7) 

K^^fcfr? «t?£»^**u*, (2) fc&Kfr Kitsnl-fitf ±v> 0 o 

/:i:x.M (3) fcv>ofc J: 9 &7 ^^ffiJfP^-^^I&^ftTV* 
(SRC: 1 2. 3 4. 5 6. 7 8, DSTI*, PROC : ACCEPT) 



^m%M%Mm§, mmu io22r;-xiP7Ki/x n 2. 34. 56. 

7 8J £#trA:fc*£»tfc*r£-KW\ ^ (3) "Ci±*<^: (2) ^Mftt 

x&ti'fz m i 3#hb) o 

[0 0 6 4] 

^i:, **7C*^ b 3 0 l±07-A*^O^t LT, Tl. 2. 3. 4 
(Ot-A'if 4 0 1 i:|p]lt^SYNA^7 Y&7 r 4 T f7 * - )\s&W.l 



(2) 



(3) 
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T^-tXflJf4p';^ MfSgH 0 2frbm&-t2>T?*Xfsimfr-)l'tLX& l (2 
) ^r^W^^-e, PROC7^]VF« TDROPJ ^MSYN 

w v v zmmtz m 1 4#jbq » 

[0 0 6 5] 

tc** h 3 0 1 ±W7-A*?>«^^ rtSB* y h 7- ^ 4_hc7)-^-/^g 

4 o i £ «fii- & c: £ § h 0 

[0 0 6 6] 

(» 2 iifi) 

2. 1) 

HIl 5fi, $»i2^Iiii;U»|ly^fA(7)yn ^itl)^ 
o ^%mm<n-y 7 ^ T -7 * -;H£g 5 fi. HI 2 1 ll»£I^£&7& 7 

70-?f-^il twfl|)RjKirafflJ 5 0 2 £ftnx., $£>KgH*g&l 0 3 Hftx. 

T\ 0 2 C^tv^r A^ISIC^fgrn <y ^icov^TJi. ISl-#if^*#Lt 

[0 0 6 7] 

Ell 5K*5V>T, |f#^5 0 1 t±, h£A7J-f&t. iffgjt t^asis 5 0 

2^A7J I P'^-y hOV-^ I PT Kl^fcffl^JU *tJ£t" -Ms ffiK £ 

i o 4 & «t v i m2<D^mm^ >?y*-xi o so^TtuMcmTj-^&o 

[0 0 6 8] 

o mrn^s o i a»fe5?#a s *& mmmmmms o 2 li^^wjfcLfcflflgifl? 

[0 0 6 9] 

2. 2) Hrffc 
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HI 6 ii. ^0Jco^2||»^^J;^ljcS^v^7 : -A<7)»/^^^-r-7D- 
[0 0 7 0] 

if> fill %W&1&<T) yrJT^*- l <h iwj^tz^ > * - * 7 
<b<7>A7J I P^ v b Z^m-fZ t Uf7 7'Al) . '^7^^10 1 

li, T^-bx$uf*m;* hWagpi o 2-em#$^Tv^r^-b^fiJfip^-;K7)[*i 
^|£A# I P/^ y h o^rSi ^{i^^tfd Uf7 7°A2) 0 

[0 0 7 1] 

2 . 2 . 1 ) MjgCJKlfS 

!§2SgK5 0 1(2. A7J I Mi^iti^'lf^d *>4>& < ti>y~xi 

m^-rz Uf77c i) o mmmw&M5 02m pt vuxt^^mmmt 

-T£- <>:rt ? T?§&o ^^(i, 0Hx.tf, n. 2. 3. 4 : 1 0J ^^i^ 

^ r< i pt Ki/^> : <mmm>] t^^tzf^^^-rn-cm^ti^T-^ 

[0 0 7 2] 

-*£flJfflLT& <fcv> 0 v>-f*U^J:. ftl<7) I P7 KV^tco^t, *tEfrt* 

fci pt ki^x^^)Si-^> i pt kvx tmmmtcomn oio^tiii; 

lgfSS£M>»g&5 0 l^aJ7J-f<5>o & I PT Kl/^hflJlWlo 

7^&^o£^Kli. ^f£I PT Kl/XC^-r&lfiiM^ LtW (MAlf 
0) StISteU ^#J$1i£S|2»g&5 0 1 KmtJ-f&tt i>iz s Mfziz K I P 

[0 0 7 3] 

^ctd i*zi%w\Hmzwm'tz> 7 7°c2) o ^#6<m(±, ix.if^ (4) 
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c [n+ 1] = c [n] +C • • • (4) 0 
[0 0 7 4] 

2 . 2. 2) mmm^m^ < ? h its 

[0 0 7 5] 

U SlJn P/n°7- y h £l*Jg»ff ^ jc-* l 0 4 £;frLTI*|g|$* >y h 7- 

LT, (9^g2^feit-r^ 0 
[0 0 7 6] 

[0 0 7 7] 

2. 2. 3) fff^SOMff^Vi 

> ^ (5) K^-fJ;?^ 0 1 frb<DX1J<0— UK 

, A^IP^^p<DAMHL (p) -eoitiU/L (p) 

c [n+1] =c [n] + 1/L (p) • • . (5) 0 
[0 0 7 8] 

-tr*#FiF (DoS) ft^gftt L£l P^y H4jE#fcjMl*32g:£&oi 
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v ^ -r A CO |ftfpi4#g£ ji>#> & d h # & o 
[0 0 7 93 

ifc, SUo-^yt Lt, st$SB5 0 1 frb<DAt}<D-~m^ A7J I h 
r 6 J £I£;eLT:2o< -<tt:\ A^J I P/^-y f^TCP^I.^:^^ if 

y&m^xz^ ^m^mmm<Dmm^m^.^ij^m^n^o &*>^a, m$r& 

[0 0 8 03 

-CUv^o MWWi, m 1 8 ic^-f i 9 I P T K 1^* MiMJt £ <9S.<7)^t 
^tlft^T, #12 0 0 1 - 1 0 1 1 5 4<&ffc (^mnAtc i&fmajii) i:fd 
fc^tiftJtft^tt^'fglMJt^S^S 0 2 K&*&tro -T<7>i#£\ i§>i^5 0 

= (a* i p y h vymmmm, xt> i p ? v 0-9- ^ *\ ?°u v a 

[0 0 8 1] 
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[0 0 8 2] 

mis (a) fi, ^«stwsrfflv^flr«jK«a«5 o 2 <Dmm^mmmx- 

[0 0 8 3] 

o £ AH l^io TH^f £ *t £ o 
[0 0 8 4] 
2. 3) JLWJ 

[0 0 8 5] 

H 1 9 tc^-T J: d fc, 4 >?~-^ y V 3±OJ£Stc** h 3 0 1 £1$^--^ 
^\ 1*1^* y b 7-? 4±Ot-/^f 4 0 1 <7>tM1M?Jl:£glft£ LT> Pin 
g Of De a t h^^cODo StiH^i^^f x.l.o 
[0 0 8 6] 

Z<D X -? I£StC** h 3 0 1 (D I P r Kl'* T 1 2 . 3 4. 5 6. 7 

8J IC^-T^«^JS^\ Bl#^5 0 1 HIS^^tL7t:L§v^J^T-e^>tL{i\ [12 
0C/Tti^:, Do S^^tM-f^ I P/tfr-y Yli&t 0 ^IM 2 ^li^ *l 
, fwsli4 0 1liri$tLl) O D o SiXWZLfrtf&X') %mMZi>^tzA 

o KvumtmfcztiZo 

[0 0 8 7] 
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(i. ^^|*if|5T>-y f7-^ 4±Ot-/^f4 0 1 ct&^-tfX^Td/^-e 
§=£o EI2 1 iz^ir X d IZ^ ^ h 3_L^S#ct)*x h 3 0 

2^£>, t-^if4 0 mmmtmmz, Vr4 

t~)vmm5<7)mm^mu5 o 2 n«t *k iiuro** f 3 0 2©ip7k 

[0 0 8 8] 

i> U h 3 0 2 co{f|SJSW-j-55-e^tL(i\ |f*g|5 5 OICJ;^ T 

WWt-^^M^n^ ist «E2 ^LTi3< 0 

, WWW+T-tfX<7)itr£\ UWL7 r 4 )P*?J?EGy t 4 )ls%t*<D^>T->V<7)mm% 
tfi^X^^o Ucfot, ®1it<7)*X h 3 0 2 iig#J<7)+f--t£x£^;tt&- 

^&v><7)T\ M1ft<D*X h 3 0 2<DI PT K PX tc^Mf HEfi±i£ Lfcfg |R 

^ v^T$r^x.fcm(i, jIHt<7)*X h 3 0 2 ^f><?)7^-t^^«t-i, I P/^ 
? h fil*]§|S* y Y 1-9 4 R(7)t-/ 1 ili4 0 1 -\^2g$tt^> 0 
[0 0 8 9] 

-co x o %mmz x i), mm~r&<7)mi?;<n^-iffrhcDT ? -b^o^-cfi, 
t^tt-/^t4 o i^^i--i> 0 Lfc^oT. at ^mm2mxmi^tr 

[0 0 9 0] 

^■9- - if x tzif z )d t n mm 2 xim-t ^^c^t^^o 

[0 0 9 1 ] 
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n y ^ BJ-cab & o ^HiflO 7yf T^t — Jl^fi 6 (i, 77-f7 l >t - ^ 
g 1 tw*3tt*^#S|51 0 3 KJjnx.T, 13 5 K^£2^ffi^JK08t*fflS5 0 1 ;fc 

i^fisti^s 0 2 ^w-r^o 

[0 0 9 2] 

AftWKWU H2 3i:^tJ:9i:, £ 1 O^igSB 1 0 3 O&jgfc LTfl 2 Oil 
1^5 0 1 £I£t7T& Jiv> 0 jjfrfc, Hi Olf^ 1 0 3 0Hu^i: LT^2<7)if^ 

SB 5 0 1 £f£tt&£ 1 &-e#& 0 

[0 0 9 3] 

, ^V^9^^ ? #fjtL^> 0 0 2 <7)M3M$ 5 0 1 T— B. -ft $1 

[0 0 9 4] 

4. i) mm 

«7I±, IH1 5«77^f 7>7*-;Vif 5 twfett*'g«IJKWai«5 5 0 2Kftx.T 
> If jlSJMSSIS 7 0 l^«$iiTv^o ««7*n^(J, El 1 5<7>£ 

[0 0 9 5] 

EI 2 4 tc^i-ct 9 K> «W£lf38B 7 0 1 f±, V T^^f Af«tf-^^- 
0 1 1, MMLSIH^ 0 12, £HHg«JKr'-*'*-;*7 0 13, £J:tf\ 
M*r&ai*&7 0 1 4 ^ii^o 
[0 0 9 6] 
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-^7 0 1 3-Mt$£1-& 0 
[0 0 9 7] 

s^«isjgT-*-^^-x 7oi3ii, i pt yvt,^ ^rfiKti^-r^mmma 
mmrnr-?^-* 7013 fc#jsu B^^ngj: 19 4>-arv^^Mff^j«r^r 

[0 0 9 8] 

4.2) IffUt^S 

^y Y V->7 3^1§2>i-a t-?<D%imiZ, |2li»7 7^7')t-^l 
5tra— C£>£ (01 6 (D 7.7- y ~7°A 1 - C1-C3, A4-A8) 0 £ 

fit, ^MBS^lf Sffiftt^ 7 0 lfi, ^y-y WmmtmTLX^ 
JblfZ X d *«IJIfIIII4t^o 
[0 0 9 9] 

02 5 izmmmwm^ 1 0 1 ^mf^mmmm^Mm^^iryu'-^^- v-c 

Jt^SSlw 0 1 1±, r;v^^ A^j^-f'-^^-x 7011 A7j£ lt 

2 5<0Xt7^Dl) o ill PT FUX\z#fc-t2>T£BJ)*ft&ZtLX\<*2>®& 
Uf^DlOY) . $fc£*<&Mi«&#J!aU if£llHS£!§*g&5 0 1 

[0 10 0] 

— yj, I pt Ki/Xic^tiS-ta^g^i; r;v^-f Ajf|gj^7"-^^-x 7 o l 
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m«Sf*-^^-^ 7 o 1 3<DmmmB<oftn a ptkvx, «^s^«t^ 

^**-HfrB#£'J) u r;M A-fgjKJg-r*-^-;* 7 o l l Mtf-L Ufy 

3 Ki>m^MB&%^^& (^x^7°D3^N) , T)v? 4^mmm r-*^ 
7°D5) , mmmzmu-tz Uf-^D2) 0 

lo 1 o 1 ] 

Ajf^Jtx-^^-^ 7011 ^feiii-^> 0 
[0 10 2] 

4. 3) T^*>f ^mmmmm^m 

^(D^m^mjLx^ w&tm&7 o 1 2(i^e^t- (0ijx.i£iBrtn) 

fiat, /^O^ (0flx.tfliira) IijHW^tL^^o^|gi:o 

v^-c, ^it^i^'; r;v^-r a^isj^t"-^^-^ 7 o i i ^i»-r&M£ 

[0 10 3] 

4.4) jy^filSj^WfM 

tfc, MifMs^7 ouii, mum Hat:) mmmm&r- 

[0 10 4] 

4. 5) nth 
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[0 10 5] 

MffMS^7 0 1 4 KiaSJHMWKr'-*^-* 7 0 1 3 051*1 
Ci^ £tx.l)g> tMiiK W:V-^ I P7 Kl/^Co^ti, 

[0 10 6] 

x&mnm 5 wit lt, e 2 3 K^-t* 3 mmfm^m mmmm^ 5 0 
mmu 7 0 1 <7>m&Rxmm&, m 2 a , 025*^^*4 iifio^tnii 

[0 10 7] 

(* e nnfm) 
e. 1) mm 

»77^77t-^ill H^tt^ilSSKl 0 3Kftx."C. /^7r901 
lis J: CM CMPHMSR9 0 1 2 **r1-&8N|E8B9 0 HW^^v^o *H 

Mi-ett $ 1 ii*^ icif^'j x h £i£tt& - 1 * < . i cmp^ 

* h^mmLxmmomm^mM^^^o mmt(Dtztb\z, 112 6-e»*ftfe 

[0 10 8] 

^•777901 l {4. ^bz&^z i^i:, ^7b7>r;^io li 
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h 7 -?^&mi-2>t&^, I CMPOT9 0 1 2frb<DHL*>iZ1&CX 
, WmLtzs^rv h ^|2«Mr/^7x-^ 1 0 5 ^^LTiSt lj mW 
2^mt-f^o I CMPS£*1£R9 0 1 2 li, il«Ii^^7x-Xl 
0 4 K.fclt£ I CMP^7 KZ>£«*fi«U ftfe<D I CMPx5-^y h 
fclfctttLfctS, ^'7779 0 1 1 CID^^7 Fffl*^tl»o # 

[0 10 9] 

6. 2) »fP 

h"C£>£ 0 £f\ IHl»77^T7t-^iIl fcR&fc, £t-Mll-f 
^7x-^ 10 0 £^LT^ V9-%v h 4 ^<b^fg LfcATJ I P/^y hi: 
ov^t, f7^v^ 1 0 n:i^7^^^'J vr-k'ttn (Xf-yfA 1, 

A2) o 

[0 110] 

I P/^ -y h(i|f*^9 0 1 0^777 9 0 11 K*flt$*i 
7 7°E 1 ) , &Mfe#Kfjl 1 <T>nW&fe4 >?7x-Xl 0 4 Sr^LTrtfflJ^y h 

A4) o £<7>^§£\ tzt^m^y b^ot^P'V h 7-^^$E^^tL 
TL^^ ^O^^H^ff-r^fr^^^tL^TCPn^^ ->3 

Ki^^^^ttLTv>^v^7ti6t^ SYN^7 h-C*^Llf 

#£Lfc*t*tWr> gtit>Fj|g££n'b-£& I CMP^7 h (^^7°3) 7^£tL& 

o 

[0 111] 

I 0 12^, il«Mi'f>^7x-7 1 0 4 t?I CMP 

^7 7h (RFC 7 9 2|E|£) tfgimZtl&t, mmi CMPs*trv h<Dftm* 
#1LT, PJ^fi^^n^-^^^^- (i~ & t> I CMP^^f "7° 3) -cs>&^s 
(^T--y-7°E3) o £U&^flB 9 --C**Uf (Xr';7E 
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3COY) „ *<D I P^-y hK^ML, >Ptn < «h & I PT Kl/^ & 

L < (±r-V *-r ^ v a > I P 7 Kl/X*ffli/>t^7 "7 t 9 0 1 1 
£^T7 Uf'7 7'E3) o ^i(0^yb-yt|)o^l±, fafc-tf"f> 

[0 112] 

£ift:'*y 779 0 1 Hi, ^<Hv-xiP7FU7U< 
lifUf^ ^-V3>IP7 Kl^KflfcoT, h^f^l" 

^>/^y hS:«iwu h zm2 <D\Hummj > ? 7 ^-^ 105^ 

Lt\ fct l9^e2^SM-t^> Uf^E4) o J^T> 1"eKj£^7t*7- y T° 
A 5 - A 8 T^Htf £*L£ 0 
[0 113] 

ZtX\ F*3SB*y h7-^ 3 0*fl I PT KW^^If^ 1 ;^ h LtffCt 
561-4 HC, S»W»C5|c^fflI PT Y\sKfcX<DXj3 I P/^y h££<h 

«® 2 ^sisi - * i t a*-? § * o 

[0 114] 

7. d mm 

12 8(±, *»l7»ii:UlWiv^fA«77^77*-;v 
US 1 0 *gf«W7n y ?MX«&Z>o e<7)7 7^77*-;^fl Oii, ± 

&Ltzm2-m5 mmftm ia^7r^77*- ;i^g k a it * rai ^ - ^mfe 
g& i o 7 i ^t * -fc-xiwfp »; * > lias i o 2 t-ftx.T, ^rs&jWRft § 

-^JS6» 1 0 0 1 £> «t § T * -bxftljfp >; X Y 1 0 0 2 £f£ 

[0 115] 

WWfr-Jl'WftMl 0 0 1 (i, ii^fv^7x-x 1 0 6 ^ihLT^i: 
2^f>^ttfl5Co^T7- MCJSCT, «ffij£tfaUB5 0 2*5^^7 0 U:^LT 

#T***f|HJ^;i/-;v£ife£U 7nxl!«'j^ h^SSBl 0 0 2 H^cDMfr 
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[0 116] 

mmmmm^s o 2^<t^7 o i j±, RfW^-^jsaji o o i ^?>o5£*f*e 

hwmui o o 2i±, iW^-;v¥iJ5Egin o o l ^omfrJ^^tr, 

-te^ffflffil'J * h £HfrU ^7^^10 1 ^f>ol^(:$Dt7^-b^ 

[0 117] 

7. 2) l&ft 

[0 118] 
[0 119] 

77^77t-;viti 0<7)^;v-;v*iJ^ l o 0 l Kit, m®^-^$\7z. 
SB l 0 7£fiJI&*K mmE*m^t-^7t^^M;i/-;v^a6^$^-rv^ 
o $]xJ4\ Ki^-;VtLT, 3fcs£ (6) 04d&^OfE^&*U4\ MISS 

RECON: c ($ IS OUR C E_I P_ADDR E S SI ) -= 1 

• • • (6) o 

[0 12 0] 

fztz.li\ »H >f7 3--7, 10 6 I P 7 KV* [12. 3 

4. 5 6. 7 8J Sr^-TT^- htf&WSBLZ WM^ — ^^l^M 1 0 0 1 (4 I 
P7K1/X T1 2. 3 4. 5 6. 7 8 J K*tt*«WK* 1 & £fl¥IRU 

*0&&«*iJ£1?Stt5 0 2/7 0 1 Hj&^-f &o 1-fcfr*>. 75- h ££&tlR 
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2 mM^Mxmm l/zXi Kmmm^m u 7 0 mm 4 mmftt 

mxmw Ltzxd ^mmm z Hff-r & m m& <n&mm. ^i^t-c, 

[0121] 

7r^f T ;Vif 1 0 Ki3»,*T\ RfrfP^-^lJ^SG 1 0 0 1 rtK, 
KW^-^*iJ5eSI5 1 0 7 tragic, T?4rXffiJfP;l/-;l/<7)£>&M£: LX<DWM^ 

r^Jtu w J * ^i" ^ >r - ;v k * tmx § & ( t tz x wm * - & \z i> mm^s 
m o witf, #C5$ (7) n^-ti^jw, grie^ (i) ^i;v-;n:EXP i 

intrusion: (src: $ |source_i p_addre s si , 

DST: *, PROCIDROP, EXPIRE 1+7DAY) • • • (7) 

o 

[0 12 2] 

L Tzifi^ T 9 - b ^>Hx-Xl 0 6 LT|»ftl^->HpJ56 

% \ 0 0 1 KfcS§$*L&fc, Wn^~^\^M \ 0 7 ^ (8 

) XiKT?** Mm fr-frtfQEJfo 2ti, 7 ? -fe * fijftl 'J * h wssb 1 0 

o 2 izfcmzti&o 

(SRC: 12. 34. 56. 78, DST:*, PROCiDROP, EXP 
IRE: + 7DAY) • • • (8) o 
[0 12 3] 

%tfty<3fz7? J kXM'M)l'-^*7?-kAm'M 1 ) * hf-^^-x 1 0 2 1 tcii 
1m-t2>o z\<Dt&, & (8) O ± 9 C E X P I R E 7 - ;V K^7 ^ -b^HJftl^ 
-JWCfEic^tlT^&lt^ T^-b^WJ^VX bfMl 0 0 2i±, SIMf^JK 

, exp i re7^ -)\< y^fcztLfzmzmnLtzwm*MitiLtz±.x\ r- 

$>^-7.*W@\-?Z> (M 7 (DTs-f - y 7° A 8 ltZHft5~$~2>) 0 
[0 12 4] 
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[212 9(i, T^-fc^fjflJfP'; J* M^g&l 0 0 2«flif^^t7n-ft- 
h-e&£o T?*:^U\W)^ Yr-?^-X 1 0 2 lj&*3E«f$*ifc&, iwv- 
X7K^ Tl 2. 34. 56. 7 81 frb<D\tJ I P '*fr y h&7 r 4 * 
-^811 OKmM-f&t, ^y~y \ 0 KiiiV-^ I PTKW 

^T^-txtlJf^';^ hflfM 0 0 2^#L-CT^-fe^Hf(|ftl^-;i/OJRW5?* 

(Xf-^A2_1) o 

[0 12 5] 

7?-fc*MPJ* M=g£M 0 0 2 ii, I PT KVXtcMtSi-^T 

^-bX|JHiV-;^Mtl) (^f7 7°A2_2, A2_3) 0 ^ (8) Kffi^ 

EXP I RE7^ K^iBIR^^^SftJISIBIta^SlfciJtlfii't* (*-r? 
7°A2_4) o 

[0 12 6] 

a^*j3&*^TSft»IIBI*jaiiL"CV^JiF^tl«i (Xt77'A2_4^)YES) , 

UfyyA2_5) , f7**h©7^WifP/l'-)l'Wyf7^^1 
0 l^teir Ux<y7 p A2_6) o *S*«!Wrt"r*iitf (Xfy7A2_ 

4ON0) , (9) i:^t«t^EXPIRE7^-;VK?-iv^7^-bX 

ai;V-]^^-;f7-f^n0 1^it Ut7 7°A2_7) o 

(SRC : 12. 34. 56. 78, DST : *, PROC : DROP) 

• • • (9) o 

[0 12 7] 

i p/^-y Y<D^m/mmmm*'tt^) (xf -7 7A2) 0 

[0 12 8] 



2003-3068006 



#m 2002-238989 



^-v: 45/ 



[0 12 9] 

^zx\ *mmmx\t, m$mmtt£^T?*xm®^-^zm^xmmm 

xztiixmmztifzmmmz&ffiz^&ztx, mmm^L^^mT mi i 
mm) ^i^^cu &t vmw^om&zmmL, &x rsaj &l< 
it mm} ^ffim^&i%mzfc&Lxfrhm\M%T?^xmM^tnmz^z. 

[0 13 0] 

£o nsnmfzmxiz, %.~<7)$>tnmw.2\zixz.x^ 2&&±.<o&t «e2 

*^ts&t ? 2 1 7^fWb*lT^& 0 

[0131] 

^«^^i3^t^#^t «fi2 fi. #7E<7>7*V Xx^f *-va > I P 7 K 
[0 13 2] 

■that t)it2 ^tw^, #^<7)'^<7)-^-e^fitt^titt-r^^^ nmm2 

*%%.tftzt)-fZ>Z.}itfX^h 0 tfc^oT, ^^^LTJESW-^lgfi^ 
J: t)fc^*r-\zx£igiit-fZ>c\ttfX£^ Ztz, #^<7)-9--e^f6jttOiE#Kif / P 

[0 13 3] 

(m 9 mm^m) 
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[0 13 4] 

z<d x 7 YmmwzwfzztX'. torn*? v v-? 3(Dmmm 

[0 13 5] 

(* 1 0 I») 

[0 13 6] 

0 1 , ±ffi|| 1 ~& 9 HJft^JKtw*3»t*^*L-P*LO«^^n y * £^|ijH-<£> yn 

f^MU^n^^A^^'J 110 2, T^-fcXftlJfP'J X h 
^^-^^^;i/-;U^fflOT'-^^-^^^*t&jfftt^7*-^^-^ 1 1 0 
3, *3J:O r #tt>f y?7jL-X 1 0 0, 1 0 4-10 6^15lt^tiTV^ 0 |BI# 

^mnm^tot oga^i*, 7 p n^^A^7°n-t-7-^2 1 o k ±1211 

~t v Y i&ffl Ltz~fu 7*7 a * •=& 1; 2 1 0 2 £ i tf? r >f T 7 * - ;v££fi i: ?M 
[0 13 7] 

(* 1 1 mm^m) 

±um i-iio iiiitit 77^7^t- ;i^g t is <h t) mm t wm^- 
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[0 13 8] 

1 l 0 1, &tt)mwm<0-7uy7AMm'7v J tv*)-2 1 0 1 
/°7^ISnyn^7A^7 h &te*flL7t:/n^7 A 110 4. 

^ct^tt^ i o oisitf i o 4*«K»te>*L-c^<5 0 *mmfm<v 

mm*, -fur? $ y n ^ a* ? h £±tag l^g^i 

mcH^l^o 7°n-t7tl 1 0 1 t7 a nt';t2 1 0 1 b*%.— 

[0 13 91 

Wffitfm^btltzt Lt^, 'Pta < t i> I P^-y ^KfE^SJlfc IP7K 
[0 14 0] 
[0141] 
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* ffiwtfi o^t xw&- z Txm ^t77^r^- ^n-eKrflH-a - tf s 

[01] 

K J: * JfcglM ->^rA <7)«h&^ 7'n ? 0 
[0 2] 

[0 3] 

12^)77^7 1 )t-^I 1 iZ&if&Tf'kXMW) * hm&U 1 0 2 cot! 
[0 4] 
[0 5] 

mnmi o 3 icisit^^^si* 1 ; x h co — m^^m^mxhho 

[0 6] 
[07] 
[0 8] 

;£!Pj3<7)iji i fy&BSo 77^77t- ^s«-er K vx^&JM^t ? i&o 

[0 9] 
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[@1 0) 

[mil] 
m 1 2] 

[0 13] 

m i mmfm k & it £ r * -t x t utp >j x h </> mff ki wo £ saw -r & tz t> <Dmn 
0-c&& o 
m 1 4] 

[@15] 
[0 16] 

[017] 

^Hifeff^ K is it S fiUS £: ? h $5^?) M# £ ^-T 7 7 "7 -Cab & 0 
[0 1 8] 

(a) t±, 9\.KmmnM*m^tzmmmwmu5 o 2 (Dummmm^&t) , 

(B) fi> ^(0-^|$:^tiflli7n7^iT^So 
[0 19] 

[02 0] 

-^*ij&0-e&£ o 

[02 1] 
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[02 2] 

tfjfifJ&^-frn -y ^lt$,^.o 
[02 3] 

H 3 mMlfZW- K <£ £ yXfA077^7f*- ;l^g <£> — $j * tf1"# 

»7*n -y 

[02 4] 

;£f§BJ3 K *3 *t & * 4 H»S i:J:Sft?l»lP^fA07r>fr^*- ^Mfi 
co— ^ij^^i-^n y ^m-^-^^o 
[02 5] 

[02 6] 
[0 2 7] 

o 

[0 2 8] 

fflol 7 Wli: utSKiy^t^«7 7 ^ 7 7 t - « l 0 £ 
^-rms&^^n >y ^0-e$)^>o 
[0 2 9] 

T?~txmm>) x h^gssi o o 2<7>t : 3aKjfp£^i~7n-^-Y- h-e&& 0 

[0 3 0] 
[03 1] 
[03 2] 
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1 77^7^*-^it 
100 ^ll^>^7x-^ 

10 1 v h 7 ■< 

102 mi oTp-kxtfmvx h^asp 

102 1 Tt^TsUW) * V -r-9^<-x 
1 0 2 2 

1 0 2 3 HfrM$l$ 
1 0 3 If #15 

1031 r vuxgmu 

104 H 1 OfWMlf'f >9 -7x-~7s 

105 %2<r>^m^y 9-7 ^-t. 

106 ffllfHK >*-7.x-* 

1 0 7 Rfftl^-^JJfeffi 

2 i3 £ 0 

2 0 1 "7°n -fe -7 -9- 

2 0 2 g&ftftffi 

3 >f > 9 — v Y 

3 0 1 &.mjt*x V 
302 jiuro** h 

4 o i -9— ^mwt 

5 77^7^- ;i^B 

5 o i if mu 
502 mm&mmu 

5 0 2 1 ntLfil^SIS 

6 7r^7^- fl/mwt 

7 77^77t-^t 

7 o i mnmwmu 
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7011 vr^fj j*mmm-r-?^-x 

7012 femmmn 

7 0 13 ft^f^Jt"^-^^-^ 

7 0 14 

8 77^7')t-^ii 

9 77^7-)*-i^l 
9 0 1 ifS^ 

9 0 11 a'-;7 7 

9 0 12 I CMPl^m^ 

10 77^77*- ;i^fi 
10 0 1 MJ^-^lJ^ 

1002 T?-kx®mv mmu 

2 1 ioi: 
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[114] 



1021 



V— XIPT K L/X 

(SRC) 


IPT K UX(DST) 


(PROC) 


* 


1.2.3.1 


ACCEPT 


* 


1.2.3.2 


ACCEPT 


12.34.1.1 


* 


ACCEPT 


* 


1.2.3.3 


DROP 


* 


* 


DENY 



[05] 



ACCEPT-/ hCDSS 

DENY—/**-* hfl)l§5(ICMPX7— 

DROP - /^^ KD«it(ICMPX7— *a»U«:i>) 



1.2. 3. 1 
1.2. 3.2 
1.2. 3. 3 

1.2. 3.5 
1.2. 3.6 
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[El 1 2] 



2 

J 

tskvmm 201 



1 



(rC:¥windows¥root.exej <D##£^) 







WRITE,C;¥lnetpub¥wwwroot¥ vti log¥*; INTRUSION 




READ, C:¥lnetpub¥wwwroot¥*; RECON 
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A. 



*2&<&&*£B8&T*f=fc<DSYN/<>r;/ h 
( V— X:12.34.56.78/-r -f Xf^^-v a >: 1.2.3.4) 




7 7>f7«>t-/l,8i 



(SRC:12.34.56.78,PST:»,PROC:PROP) 
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1 5] 
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100 
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